pub fn control_mark_path(repo_root: &Path, mission_id: &str) -> Option<PathBuf>Expand description
Where a mission’s CONTROL MARK lives: the name of the last control file
the engine acknowledged, recorded beside the high-water mark. Control
file names are <zero-padded-nanos>-<8-hex>.json, so they order
lexicographically by creation time and the mark never moves backwards.
The mark is what makes a signed control file single-use. The signature
binds the file to its name, and the engine refuses any name at or below
the mark, so a captured approve-grant re-dropped after the drain
deleted it authenticates but is refused as a replay (follow-up review
F-1).